From 364c726dbbf2980e6ec2fb7f7d766a58def882f8 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Thu, 3 Sep 2026 09:55:56 -0400 Subject: [PATCH] ci: add release.yml for npm publish on v* tags; fix author field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P1 root cause (2026-09-03): published 1.0.8 crashed on every fresh install (ReferenceError "module is not defined in ES module scope" in the sdk chunk) because package.json pinned sdk with a caret range (^2.0.11) that later resolved to a broken sdk release (2.1.2). 1.0.9 (already merged, PR #39) pins sdk to an exact 2.0.14 — but nothing published it, because this repo had no release workflow, only _checks/foundation-gate/ issue-ops-triage/public-repo-guard. A laptop npm publish was the only path to npmjs, with no build/test/smoke gate in front of it. Adds .github/workflows/release.yml: triggered on v* tags, verifies the tag matches package.json version, npm ci, build, test, npm pack, smokes the packed tarball in a throwaway project (npm i tarball && npx wave --version, compared against package.json version) — the exact check 1.0.8 shipped without — then npm publish --provenance --access public. Auth is npm trusted publishing (OIDC via id-token: write) when this repo + workflow is registered as a trusted publisher on npmjs; falls back to the NPM_TOKEN repo secret otherwise (set only if the secret is present). All actions are SHA-pinned, matching this repo and wave-foundations release-spoke-chassis.yml convention. Also fixes package.json author from "WAVE Inc. " to the correct legal entity "WAVE Online, LLC". Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01K9mRh8G2ugbUt2kaXvFvF6 --- .github/workflows/release.yml | 102 ++++++++++++++++++++++++++++++++++ package.json | 2 +- 2 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..0c8f598 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,102 @@ +# release.yml — publish @wave-av/cli to public npm on a `v*` tag. +# +# Fixes the 2026-09-03 P1: 1.0.8 shipped with an unpinned SDK dependency range that later +# resolved to a broken SDK release (crashed every fresh install with "module is not defined +# in ES module scope"). Until this file, publishing was a manual `npm publish` run from a +# laptop with no build/test/smoke gate in front of it. This workflow is the missing release +# path: every future version now ships through CI with a build + test + tarball smoke test +# before anything reaches npmjs. +# +# Publish: push a tag `v` matching package.json "version" (e.g. `v1.0.9`). The job +# fails closed if the tag and package.json disagree, so a stale tag can never publish the +# wrong version. +# +# Auth: npm trusted publishing (OIDC via `id-token: write`) is used automatically once this +# package is registered as a trusted publisher on npmjs for wave-av/cli + this workflow file. +# Until that registration exists, the `NPM_TOKEN` repository secret is used as a classic +# auth-token fallback (set only if present — an empty/missing secret does not touch .npmrc). +# Either path works with zero further changes to this file. + +name: release + +on: + push: + tags: + - "v*" + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + +permissions: + contents: read + +jobs: + release: + name: build, test, smoke, publish + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + id-token: write # npm trusted publishing (OIDC) — unused when the NPM_TOKEN fallback applies + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false + + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "22" + + - name: Verify tag matches package.json version + run: | + PKG_VERSION="$(node -p "require('./package.json').version")" + TAG_VERSION="${GITHUB_REF_NAME#v}" + if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then + echo "::error::tag $GITHUB_REF_NAME ($TAG_VERSION) != package.json version ($PKG_VERSION)" + exit 1 + fi + + - name: Install + run: npm ci --include=dev + + - name: Build + run: npm run build + + - name: Test + run: npm test + + - name: Pack + run: npm pack + + - name: Smoke test the packed tarball + # Installs the ACTUAL tarball npm publish would upload (not the source tree) into a + # throwaway project on the default public registry, then runs the built CLI exactly the + # way a fresh `npx @wave-av/cli` user would — this is the check 1.0.8 shipped without. + run: | + TARBALL="$(ls ./wave-av-cli-*.tgz)" + SMOKE_DIR="$(mktemp -d)" + cd "$SMOKE_DIR" + npm init -y >/dev/null + npm i "$GITHUB_WORKSPACE/$TARBALL" + VERSION="$(npx wave --version)" + EXPECTED="$(node -p "require('$GITHUB_WORKSPACE/package.json').version")" + echo "smoke: wave --version -> $VERSION (expected $EXPECTED)" + if [ "$VERSION" != "$EXPECTED" ]; then + echo "::error::tarball smoke test failed: got '$VERSION', expected '$EXPECTED'" + exit 1 + fi + + - name: Configure npm auth (NPM_TOKEN fallback only — OIDC trusted publishing needs no config here) + env: + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + run: | + if [ -n "$NPM_TOKEN" ]; then + echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc + echo "npm auth: using NPM_TOKEN secret fallback" + else + echo "npm auth: no NPM_TOKEN secret set — relying on OIDC trusted publishing" + fi + + - name: Publish to npm + run: npm publish --provenance --access public diff --git a/package.json b/package.json index e1f5e6a..3272501 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,7 @@ "rtmp", "terminal" ], - "author": "WAVE Inc. ", + "author": "WAVE Online, LLC", "license": "MIT", "repository": { "type": "git",